As Yanming reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215894
I have encountered a bug in F2FS file system in kernel v5.17.
I have uploaded the system call sequence as case.c, and a fuzzed image can
be found in google net disk
The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can
reproduce the bug by running the following commands:
kernel BUG at fs/f2fs/segment.c:2291!
Call Trace:
f2fs_invalidate_blocks+0x193/0x2d0
f2fs_fallocate+0x2593/0x4a70
vfs_fallocate+0x2a5/0xac0
ksys_fallocate+0x35/0x70
__x64_sys_fallocate+0x8e/0xf0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
The root cause is, after image was fuzzed, block mapping info in inode
will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause
panic when updating SIT with invalid blkaddr.
Let's fix the issue by adding sanity check on block address before updating
SIT table with it.
Cc: stable(a)vger.kernel.org
Reported-by: Ming Yan <yanming(a)tju.edu.cn>
Signed-off-by: Chao Yu <chao.yu(a)oppo.com>
---
fs/f2fs/file.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index f08e6208e183..342b1f17a033 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1437,11 +1437,19 @@ static int f2fs_do_zero_range(struct dnode_of_data *dn, pgoff_t start,
ret = -ENOSPC;
break;
}
- if (dn->data_blkaddr != NEW_ADDR) {
- f2fs_invalidate_blocks(sbi, dn->data_blkaddr);
- dn->data_blkaddr = NEW_ADDR;
- f2fs_set_data_blkaddr(dn);
+
+ if (dn->data_blkaddr == NEW_ADDR)
+ continue;
+
+ if (!f2fs_is_valid_blkaddr(sbi, dn->data_blkaddr,
+ DATA_GENERIC_ENHANCE)) {
+ ret = -EFSCORRUPTED;
+ break;
}
+
+ f2fs_invalidate_blocks(sbi, dn->data_blkaddr);
+ dn->data_blkaddr = NEW_ADDR;
+ f2fs_set_data_blkaddr(dn);
}
f2fs_update_extent_cache_range(dn, start, 0, index - start);
--
2.25.1
This is the start of the stable review cycle for the 4.14.277 release.
There are 43 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 28 Apr 2022 08:17:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.277-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.277-rc1
Marek Vasut <marex(a)denx.de>
Revert "net: micrel: fix KS8851_MLL Kconfig"
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix UAF bugs in ax25 timers
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereferences in ax25 timers
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: fix NPD bug in ax25_disconnect
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: fix UAF bug in ax25_send_control()
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix refcount leaks caused by ax25_cb_del()
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: fix UAF bugs of net_device caused by rebinding operation
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: fix reference count leaks of ax25_dev
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: add refcount in ax25_dev to avoid UAF bugs
Khazhismel Kumykov <khazhy(a)google.com>
block/compat_ioctl: fix range check in BLKGETSIZE
Lee Jones <lee.jones(a)linaro.org>
staging: ion: Prevent incorrect reference counting behavour
Theodore Ts'o <tytso(a)mit.edu>
ext4: force overhead calculation if the s_overhead_cluster makes no sense
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix overhead calculation to account for the reserved gdt blocks
Tadeusz Struk <tadeusz.struk(a)linaro.org>
ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
Ye Bin <yebin10(a)huawei.com>
ext4: fix symlink file size not match to file content
Sergey Matyukevich <sergey.matyukevich(a)synopsys.com>
ARC: entry: fix syscall_trace_exit argument
Sasha Neftin <sasha.neftin(a)intel.com>
e1000e: Fix possible overflow in LTR decoding
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
ASoC: soc-dapm: fix two incorrect uses of list iterator
Paolo Valerio <pvalerio(a)redhat.com>
openvswitch: fix OOB access in reserve_sfa_size()
Athira Rajeev <atrajeev(a)linux.vnet.ibm.com>
powerpc/perf: Fix power9 event alternatives
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
dma: at_xdmac: fix a missing check on list iterator
Zheyu Ma <zheyuma97(a)gmail.com>
ata: pata_marvell: Check the 'bmdma_addr' beforing reading
Mikulas Patocka <mpatocka(a)redhat.com>
stat: fix inconsistency between struct stat and struct compat_stat
Tomas Melin <tomas.melin(a)vaisala.com>
net: macb: Restart tx only if queue pointer is lagging
Xiaoke Wang <xkernel.wang(a)foxmail.com>
drm/msm/mdp5: check the return of kzalloc()
Borislav Petkov <bp(a)alien8.de>
brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
David Howells <dhowells(a)redhat.com>
cifs: Check the IOCB_DIRECT flag, not O_DIRECT
Hongbin Wang <wh_bin(a)126.com>
vxlan: fix error return code in vxlan_fdb_append
Borislav Petkov <bp(a)suse.de>
ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant
Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com>
platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
Kees Cook <keescook(a)chromium.org>
ARM: vexpress/spc: Avoid negative array index when !SMP
Eric Dumazet <edumazet(a)google.com>
netlink: reset network and mac headers in netlink_dump()
Hangbin Liu <liuhangbin(a)gmail.com>
net/packet: fix packet_sock xmit return value checking
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: imx-sdma: Fix error checking in sdma_event_remap
Kuniyuki Iwashima <kuniyu(a)amazon.co.jp>
tcp: Fix potential use-after-free due to double kfree()
Ricardo Dias <rdias(a)singlestore.com>
tcp: fix race condition when creating child sockets from syncookies
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Clear MIDI port active flag after draining
Bob Peterson <rpeterso(a)redhat.com>
gfs2: assign rgrp glock before compute_bitstructs
Hangyu Hua <hbh25y(a)gmail.com>
can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path
Daniel Bristot de Oliveira <bristot(a)kernel.org>
tracing: Dump stacktrace trigger to the corresponding instance
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Have traceon and traceoff trigger honor the instance
Xiongwei Song <sxwjean(a)gmail.com>
mm: page_alloc: fix building error on -Werror=array-compare
Kees Cook <keescook(a)chromium.org>
etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/entry.S | 1 +
arch/arm/mach-vexpress/spc.c | 2 +-
arch/powerpc/perf/power9-pmu.c | 8 +--
arch/x86/include/asm/compat.h | 6 +-
block/compat_ioctl.c | 2 +-
drivers/ata/pata_marvell.c | 2 +
drivers/dma/at_xdmac.c | 12 ++--
drivers/dma/imx-sdma.c | 4 +-
drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c | 3 +
drivers/net/can/usb/usb_8dev.c | 30 +++++-----
drivers/net/ethernet/cadence/macb_main.c | 8 +++
drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 +-
drivers/net/ethernet/micrel/Kconfig | 1 -
drivers/net/vxlan.c | 4 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
drivers/platform/x86/samsung-laptop.c | 2 -
drivers/staging/android/ion/ion.c | 3 +
fs/cifs/cifsfs.c | 2 +-
fs/ext4/inode.c | 11 +++-
fs/ext4/page-io.c | 4 +-
fs/ext4/super.c | 19 ++++--
fs/gfs2/rgrp.c | 9 +--
fs/stat.c | 19 +++---
include/linux/etherdevice.h | 5 +-
include/net/ax25.h | 12 ++++
include/net/inet_hashtables.h | 5 +-
kernel/trace/trace_events_trigger.c | 61 ++++++++++++++++---
mm/page_alloc.c | 2 +-
net/ax25/af_ax25.c | 38 +++++++++---
net/ax25/ax25_dev.c | 28 +++++++--
net/ax25/ax25_route.c | 13 ++++-
net/ax25/ax25_subr.c | 20 +++++--
net/dccp/ipv4.c | 2 +-
net/dccp/ipv6.c | 2 +-
net/ipv4/inet_connection_sock.c | 2 +-
net/ipv4/inet_hashtables.c | 68 +++++++++++++++++++---
net/ipv4/tcp_ipv4.c | 13 ++++-
net/ipv6/tcp_ipv6.c | 13 ++++-
net/netlink/af_netlink.c | 7 +++
net/openvswitch/flow_netlink.c | 2 +-
net/packet/af_packet.c | 13 +++--
sound/soc/soc-dapm.c | 6 +-
sound/usb/midi.c | 1 +
sound/usb/usbaudio.h | 2 +-
45 files changed, 357 insertions(+), 120 deletions(-)
This is the start of the stable review cycle for the 4.9.312 release.
There are 24 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 28 Apr 2022 08:17:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.312-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.312-rc1
Khazhismel Kumykov <khazhy(a)google.com>
block/compat_ioctl: fix range check in BLKGETSIZE
Theodore Ts'o <tytso(a)mit.edu>
ext4: force overhead calculation if the s_overhead_cluster makes no sense
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix overhead calculation to account for the reserved gdt blocks
Tadeusz Struk <tadeusz.struk(a)linaro.org>
ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
Sergey Matyukevich <sergey.matyukevich(a)synopsys.com>
ARC: entry: fix syscall_trace_exit argument
Sasha Neftin <sasha.neftin(a)intel.com>
e1000e: Fix possible overflow in LTR decoding
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
ASoC: soc-dapm: fix two incorrect uses of list iterator
Paolo Valerio <pvalerio(a)redhat.com>
openvswitch: fix OOB access in reserve_sfa_size()
Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
dma: at_xdmac: fix a missing check on list iterator
Zheyu Ma <zheyuma97(a)gmail.com>
ata: pata_marvell: Check the 'bmdma_addr' beforing reading
Xiaoke Wang <xkernel.wang(a)foxmail.com>
drm/msm/mdp5: check the return of kzalloc()
Borislav Petkov <bp(a)alien8.de>
brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
David Howells <dhowells(a)redhat.com>
cifs: Check the IOCB_DIRECT flag, not O_DIRECT
Hongbin Wang <wh_bin(a)126.com>
vxlan: fix error return code in vxlan_fdb_append
Borislav Petkov <bp(a)suse.de>
ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant
Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com>
platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
Kees Cook <keescook(a)chromium.org>
ARM: vexpress/spc: Avoid negative array index when !SMP
Eric Dumazet <edumazet(a)google.com>
netlink: reset network and mac headers in netlink_dump()
Hangbin Liu <liuhangbin(a)gmail.com>
net/packet: fix packet_sock xmit return value checking
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: imx-sdma: Fix error checking in sdma_event_remap
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Clear MIDI port active flag after draining
Bob Peterson <rpeterso(a)redhat.com>
gfs2: assign rgrp glock before compute_bitstructs
Xiongwei Song <sxwjean(a)gmail.com>
mm: page_alloc: fix building error on -Werror=array-compare
Kees Cook <keescook(a)chromium.org>
etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
-------------
Diffstat:
Makefile | 4 ++--
arch/arc/kernel/entry.S | 1 +
arch/arm/mach-vexpress/spc.c | 2 +-
block/compat_ioctl.c | 2 +-
drivers/ata/pata_marvell.c | 2 ++
drivers/dma/at_xdmac.c | 12 +++++++-----
drivers/dma/imx-sdma.c | 4 ++--
drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c | 3 +++
drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 ++--
drivers/net/vxlan.c | 4 ++--
.../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
drivers/platform/x86/samsung-laptop.c | 2 --
fs/cifs/cifsfs.c | 2 +-
fs/ext4/inode.c | 11 ++++++++++-
fs/ext4/super.c | 19 +++++++++++++++----
fs/gfs2/rgrp.c | 9 +++++----
include/linux/etherdevice.h | 5 ++---
mm/page_alloc.c | 2 +-
net/netlink/af_netlink.c | 7 +++++++
net/openvswitch/flow_netlink.c | 2 +-
net/packet/af_packet.c | 13 +++++++++----
sound/soc/soc-dapm.c | 6 ++----
sound/usb/midi.c | 1 +
sound/usb/usbaudio.h | 2 +-
24 files changed, 79 insertions(+), 42 deletions(-)